Openrc generation escapes special characters

[Flavio Percoco]

When special characters are used in tenant names, horizon escapes them when generating openrc.sh for example & is written as &

A first effort to fix this was made in this review[0] but as Gabriel pointed out, it turns out to be a security issue. That for, this review was reverted and a new one[1] was created as a work in progress in order to find a good and secure way to fix this.

I guess the main 2 options are:

1) We don't allow special characters to be input
2) We allow just a set of special characters

Hopefully, we can come out with a better way to fix this.

[0] https://review.openstack.org/#/c/19672/

[1] https://review.openstack.org/#/c/19740/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/20018

[Gabriel Hurley (gabriel-hurley)]

So, what I'd like to see happen here is to use a custom template filter that would allow a small subset of characters which could not be harmful when inserted into a terminal command string. That would probably *not* include quotation marks, apostrophes, semicolons, etc.
I think that should satisfy the needs of everyone involved while maintaining reasonable security.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/20018
Committed: http://github.com/openstack/horizon/commit/99b678b7b7d8eb78a39e5600136f675e875f8e30
Submitter: Jenkins
Branch: master

commit 99b678b7b7d8eb78a39e5600136f675e875f8e30
Author: Flavio Percoco <email address hidden>
Date: Fri Jan 18 12:26:30 2013 +0100

    Remove |safe from openrc.template

    Review I56ec047da467b721bd1b57d2c97d05717e83f468 added |safe to
    the TEMPLATE_NAME variable in order to allow special characters for
    tenant names but it turned out to be a security issue as explained in
    one of the comments.

    This reverts commit 3a9b0da489030eaacc6cc0416f92192b74783ac8

    It's still an issue to discuss as referenced in bug 1100042

    Change-Id: I919a56ac799e3358bf3d56af3c6083814e97c98d

[Julie Pichon (jpichon)]

It looks like the "Fix released" status of this should be reverted back to "New" from the comment history: the patch was reverted and the bug still needs to be fixed.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/39916

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/39916
Committed: http://github.com/openstack/horizon/commit/53429da44150b13987009577c12ebd7a711ef634
Submitter: Jenkins
Branch: master

commit 53429da44150b13987009577c12ebd7a711ef634
Author: Matthias Runge <email address hidden>
Date: Fri Aug 2 14:31:51 2013 +0200

    Apply a tempate filter to output for openrc.sh

    When special characters are used in tenant names, horizon escapes them
    when generating openrc.sh for example & is written as &amp;

    Change-Id: I3fbb6c66c6ccc09ad48eb224e26ab9851191bb46
    Fixes: bug #1100042